Security

How your account is protected

• Passwords are never stored. What is stored is an Argon2id hash (19 MiB, 2 passes), which is slow on purpose: a stolen database cannot be guessed through quickly. Passwords must be at least 8 characters and cannot be on the list of common passwords.
• A new device needs a code. The first sign-in from a device the account has never used is told what the server sees (the device, the estimated place, the IP address) and must enter a six-digit code sent to your email. The account gets an email about it too.
• Two-step verification with an authenticator app, turned on in Account settings. Ten one-use backup codes are shown once when you turn it on, in case you lose the phone. Staff accounts must have it on.
• A PIN on each character. Four digits, asked every time that character is played. The pad shuffles its digits each time, so a recorded click pattern is useless. Five wrong tries lock the character for 15 minutes, then an hour, and you get an email.
• Wrong guesses are slowed down. Five wrong passwords on an account mean a wait that doubles up to 15 minutes; an address that keeps guessing meets a check and is then refused for an hour. None of this can lock you out of your own remembered device.
• You can see everything. Account settings list every device signed in and an activity history (sign-ins, new devices, wrong passwords, changes) with time, place and address, 180 days back. Changing your password signs every other device out.
• Emails carry codes, not links. Nothing we send asks you to click through and sign in.

What you should do

1. Use a password you use for nothing else.
2. Turn on two-step verification and keep the backup codes somewhere safe.
3. Put a PIN on the characters you care about.
4. Only download the game from this site, and check the SHA-256 if in doubt.

Staff will never ask for your password

Not in game, not on the Discord, not by email. Nor for your two-step codes or your PIN, and never for items "to check them". Anyone who does is not staff, whatever their name or icon looks like. Screenshot it and report it on the Support page.

Reporting a security problem

If you find a hole in the game, the website, the launcher or the account service, or you think your account has been taken over, write to security@paradox.ps. Tell us what you found and how to see it; please do not post it in public until it is fixed. We read every report and answer in person.